Ads keep popping up (similar issue thats been recently reported)

[DownInTexas]

While doing a search for an issue I'm having, I found a recent thread similar to my own problem. That thread is here.

I've attached the dds and attach logs below.

If you think I should follow the steps mentioned in referenced thread, please let me know and I'll report back.

TIA!

attach.txt

dds.txt

[MrCharlie]

Welcome to the forum.

Please remove any usb or external drives from the computer before you run this scan!

Please download and run RogueKiller to your desktop.

Quit all running programs.

For Windows XP, double-click to start.

For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.

Click Scan to scan the system.

When the scan completes > Close out the program > Don't Fix anything!

Don't run any other options, they're not all bad!!!!!!!

Post back the report which should be located on your desktop.

MrC

------->Your topic will be closed if you haven't replied within 3 days!<--------

(If I don't respond within 48 hours, please send me a PM)

[DownInTexas]

Thanks for the response.

Please see attached.

RKreport1_S_12112012_02d1016.txt

[MrCharlie]

Please read the directions carefully so you don't end up deleting something that is good!!

Please note that TDSSKiller can be run in safe mode if needed.

Here's a video that explains how to run it if needed:

Please download the latest version of TDSSKiller from here and save it to your Desktop.

• Doubleclick on TDSSKiller.exe to run the application, then click on Change parameters.
  
  
• Put a checkmark beside loaded modules.
  
  
• A reboot will be needed to apply the changes. Do it.
  
• TDSSKiller will launch automatically after the reboot. Also your computer may seem very slow and unusable. This is normal. Give it enough time to load your background programs.
  
• Then click on Change parameters in TDSSKiller.
  
• Check all boxes then click OK.
  
  
• Click the Start Scan button.
  
  
• The scan should take no longer than 2 minutes.
  
• If a suspicious object is detected, the default action will be Skip, click on Continue.
  
  Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
  Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.
  
• A report will be created in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here. There may be 3 logs > so post or attach all of them.
  
• Sometimes these logs can be very large, in that case please attach it or zip it up and attach it.
  

Here's a summary of what to do if you would like to print it out:

If a suspicious object is detected, the default action will be Skip, click on Continue

If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose

Skip and click on Continue

Any entries like this: \Device\Harddisk0\DR0 ( TDSS File System ) - please choose Skip.

If malicious objects are found, they will show in the Scan results and offer three (3) options.

Ensure Cure is selected, then click Continue => Reboot now to finish the cleaning process.

Note: If Cure is not available, please choose Skip instead, do not choose Delete unless instructed.

~~~~~~~~~~~~~~~~~~~~

You can attach the logs if they're too long:

Bottom right corner of this page.

New window that comes up.

MrC

[DownInTexas]

Please see attached log from TDSSKiller.

Thanks again for all your help!

[MrCharlie]

Did it find anything and there should be a couple of more logs, MrC

[DownInTexas]

11 threats were found but there was no option to cure, only to delete quarantine or skip.

One was a hidden file, all the others were unsigned files - none were detected as malicious.

I ran the application again, and it generated a similar report. I started a new notepad document c/p everything in the Reports, section of the application. The file "second report" attached to this post is what was c/p from the application itself.

TDSSKiller.2.8.15.0_11.12.2012_11.25.28_log.txt

TDSSKiller.2.8.15.0_11.12.2012_11.59.40_log.txt

Second Report.txt

[MrCharlie]

Those files are OK..........

Please download and run ComboFix.

The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.

Please visit this webpage for download links, and instructions for running ComboFix

http://www.bleepingc...to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Information on disabling your malware programs can be found Here.

Make sure you run ComboFix from your desktop.

Give it at least 30-45 minutes to finish if needed.

Please include the C:\ComboFix.txt in your next reply for further review.

---------->NOTE<----------

If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.

MrC

[DownInTexas]

Combofix just completed.

Please see attached log.

Log.txt

[MrCharlie]

Looks like you ran ComboFix several times already.

Completion time: 2012-12-11  15:04:27
ComboFix-quarantined-files.txt  2012-12-11 21:04
ComboFix2.txt  2012-12-06 17:28
ComboFix3.txt  2012-11-21 15:12
ComboFix4.txt  2012-09-20 14:55
ComboFix5.txt  2012-12-11 20:53

.

Please download AdwCleaner from here and save it on your Desktop.

1. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.
   
2. Now click on the Search tab.
   
3. Please post the contents of the log-file created in your next post.
   

Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.

MrC

[DownInTexas]

Please see attached.

Thanks for all your help!!

AdwCleanerR1.txt

[MrCharlie]

Some adware found....lets clear it out.....

1. Please re-run AdwCleaner
   
2. Click on Delete button.
   
3. Confirm each time with OK if asked.
   
4. Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
   

Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.

Then..........

Lets check your computers security before you go and we have a little cleanup to do also:

Download Security Check by screen317 from HERE or HERE.

• Save it to your Desktop.
  
• Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  
• A Notepad document should open automatically called checkup.txt.
  
• Please Post the contents of that document.
  
• Do Not Attach It!!!
  

MrC

[DownInTexas]

Please see attached after deleting and rebooting with AdwCleaner.

WIthin in the **** is a c/p from the Secruity Check.

*****

m Results of screen317's Security Check version 0.99.56

Windows 7 Service Pack 1 x64 (UAC is disabled!)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Disabled!

Trend Micro Titanium Internet Security

Antivirus up to date! (On Access scanning disabled!)

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.65.1.1000

Eusing Free Registry Cleaner

Java 6 Update 26

Java 7 Update 9

Java 6 Update 3

Adobe Flash Player 11.3.300.257 Flash Player out of Date!

Adobe Reader 10.1.4 Adobe Reader out of Date!

Mozilla Firefox (17.0.1)

````````Process Check: objlist.exe by Laurent````````

Trend Micro Titanium TiMiniService.exe

Trend Micro Titanium TiResumeSrv.exe

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 32% Defragment your hard drive soon! (Do NOT defrag if SSD!)

````````````````````End of Log``````````````````````

*****

For what its worth, the UAC and Firewall are turned off because we run programs that need them to be turned off (UAC) and the firewall is turned off when I am logged into the domain.

After deleting the files found by AdwCleaner I'm still having trouble. I run the noscript addon within firefox and it helps prevent these popups but also makes browsing any new sites a real pain.

AdwCleanerS1.txt

[MrCharlie]

OK....please do this >>>

Please download OTL from one of the links below:

http://oldtimer.geekstogo.com/OTL.exe

http://www.itxassoci...T-Tools/OTL.exe

http://oldtimer.geekstogo.com/OTL.com (<---renamed version)

Save it to your desktop.

Double click on the icon on your desktop.

Click the Scan All Users checkbox.

Push the Quick Scan button.

The scan will take about 10 minutes...depends on your hard drive size.

Two reports will open, copy and paste them in a reply here: (or attach them as .txt files)

OTL.txt <-- Will be opened

Extra.txt <-- Will be minimized

MrC

[DownInTexas]

Please see attached logs.

Extras.Txt

OTL.Txt

[MrCharlie]

Please find this file and upload to VirusTotal for a free scan, let me know the results (just copy back the url)

http://www.virustotal.com/

C:\Windows\SysNative\acovcnt.exe

~~~~~~~~~~~~~~~~~~~~~~~~~

Go to the link below and run FixIt to reset your host file:

http://support.microsoft.com/kb/972034

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please do this:

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in bold:

:OTL

O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll File not found

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4:64bit: - HKLM..\Run: [intelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found

@Alternate Data Stream - 1167 bytes -> C:\ProgramData\Microsoft:xnLPOtCintneatvOlwLHs6

@Alternate Data Stream - 1025 bytes -> C:\ProgramData\Microsoft:n4RoQs4lj3ATJxQYmsPCJDnR

:Commands

[EMPTYJAVA]

[emptytemp]

[EMPTYFLASH]

[*]Then click the Run Fix button at the top

[*]Let the program run unhindered, when done it will say "Fix Complete press ok to open the log"

[*]Please post that log in your next reply. Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTL\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

MrC

[DownInTexas]

*****

antivirus scan on acovcnt.exe result:

https://www.virustotal.com/file/aaf659e3d38ad04848a9c3ed6250b30dc13acc8ac9f527a11f0c14e6ec8735b2/analysis/1355342052/

*****

ran the MS fix it

*****

Results from Run the Fix per the previous post:

All processes killed

========== OTL ==========

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked not found.

64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\IntelTBRunOnce not found.

Unable to delete ADS C:\ProgramData\Microsoft:xnLPOtCintneatvOlwLHs6 .

Unable to delete ADS C:\ProgramData\Microsoft:n4RoQs4lj3ATJxQYmsPCJDnR .

========== COMMANDS ==========

[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User:

->Java cache emptied: 0 bytes

User:

->Java cache emptied: 0 bytes

User:

->Java cache emptied: 0 bytes

User: Public

User: UpdatusUser

Total Java Files Cleaned = 0.00 mb

[EMPTYTEMP]

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

User:

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 0 bytes

->Flash cache emptied: 0 bytes

User:

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 0 bytes

->Flash cache emptied: 0 bytes

User: .NA

->Temp folder emptied: 1202 bytes

->Temporary Internet Files folder emptied: 2443596 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 74116826 bytes

->Flash cache emptied: 57749 bytes

User: Public

->Temp folder emptied: 0 bytes

User: UpdatusUser

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

->Flash cache emptied: 56466 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 10503578 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 62804 bytes

RecycleBin emptied: 7309622 bytes

Total Files Cleaned = 90.00 mb

[EMPTYFLASH]

User: All Users

User: Default

->Flash cache emptied: 0 bytes

User: Default User

->Flash cache emptied: 0 bytes

User:

->Flash cache emptied: 0 bytes

User:

->Flash cache emptied: 0 bytes

User:

->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser

->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 12122012_141345

Files\Folders moved on Reboot...

C:\Users\.\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

C:\Windows\temp\wbxtra_12122012_141030.wbt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

*****

[MrCharlie]

Is there any difference?? MrC

[DownInTexas]

Still getting the popups, but they seem to be occurring less frequently though. For example, if I load a page, they may not pop up, but if I refresh the page, they pop up then. Also, sometimes only one of the two will pop up.

[MrCharlie]

Is it just when you're online? What browser? MrC

[DownInTexas]

When I'm online, and with any browser (I only use either FF or IE).

I've attached a screen shot of what the popups looks like. They only appear to run on sites with lots of advertising. For example, on this site, they have never popped up. But when I end up on pages with lots of scripts running in the background, thats when I see them.

Doc1.pdf

[MrCharlie]

Please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

http://www.eset.eu/online-scanner

Tick the box next to YES, I accept the Terms of Use.

Click Start

When asked, allow the ActiveX control to install

Click Start

Make sure that the options Remove found threats and the option Scan unwanted applications is checked

Click Advanced settings and select the following:

• Scan potentially unwanted applications
  
• Scan for potentially unsafe applications
  
• Enable Anti-Stealth technology
  

Click Start

Wait for the scan to finish

Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt

Copy and paste that log as a reply to this topic

MrC

[DownInTexas]

Thanks for your continued support to help me with this problem.

The ESET scan found 6 threats, all were automatically deleted.

I've c/p the results from ESET within the *****

*****

C:\Qoobox\Quarantine\C\Program Files (x86)\StartNow Toolbar\StartNowToolbarUninstall.exe.vir Win32/Toolbar.Zugo application cleaned by deleting - quarantined

C:\Qoobox\Quarantine\C\Program Files (x86)\StartNow Toolbar\ToOLbar32.dll.vir a variant of Win32/Toolbar.Zugo application cleaned by deleting - quarantined

C:\Qoobox\Quarantine\C\Program Files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe.vir a variant of Win32/Toolbar.Zugo application cleaned by deleting - quarantined

C:\Qoobox\Quarantine\C\Windows\System32\consrv.dll.vir Win64/Sirefef.G trojan cleaned by deleting - quarantined

C:\\Downloads\cnet_HandBrake-0_9_5-Win_GUI_exe.exe a variant of Win32/InstallCore.D application cleaned by deleting - quarantined

C:\\Downloads\Speedtest_TuneUpUtilities2012_en-US.exe a variant of Win32/OpenInstall application cleaned by deleting - quarantined

*****

[DownInTexas]

Rebooted the machine, cleared out history, cache, etc in the browsers, and I'm still having the same popups.

[MrCharlie]

These types of infections can be troublesome to track down some times.

Reset IE back to defaults and see how it is:

http://support.microsoft.com/kb/923737

if there's still aproblem....

Reset FF back to defaults and see how it is:

http://support.mozil...x-most-problems

Let me know.....MrC